@wtfalch/foundry 0.16.16 → 0.17.0

package/dist/plan/platform-diff.d.ts

@@ -309,6 +309,20 @@ export declare const PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY = "coolify_platform
 export declare const PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF = "platform:master:coolify-url";
 export declare const PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF = "platform:master:coolify-token";
 export declare const PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF = "platform:master:cloudflare-token";
+/**
+ * #436: a Coolify API token scoped to `read` only, for Archon's own
+ * `/backups` page (`COOLIFY_URL`/`COOLIFY_READ_TOKEN`, Archon's
+ * `src/lib/backups/coolify.ts`) -- deliberately not
+ * {@link PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF}'s root token, which a
+ * read-only status page must never hold. Coolify's token UI has no API
+ * counterpart to create one (`@wtfalch/providers`'s `CoolifyClient` doc:
+ * "Keys & Tokens -> API tokens" only), so a human creates it in Coolify's
+ * console and holds it under this ref; `provisionPlatformArchon` only reads
+ * it back, and pushes nothing until it is held. `COOLIFY_URL` needs no ref
+ * of its own: it is not secret, and {@link PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF}
+ * already holds the same panel's address.
+ */
+export declare const PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF = "platform:archon:coolify-read-token";
 /**
  * #169: `platform:<service>` for the platform's own mail server (Stalwart),
  * mirroring {@link PLATFORM_AUTH_KEY} exactly.

package/dist/plan/platform-diff.js

@@ -2,6 +2,7 @@ import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
 import { legacyAppHostname } from './hostnames.js';
+import { withStepSystem } from './step-system.js';
 /**
  * The `Plan` (#19's public contract) a {@link PlatformPlanDetail} carries,
  * mirroring `diff.ts`'s `toPlan`. There is no separate platform-shaped `Plan`
@@ -343,6 +344,20 @@ export const PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY = 'coolify_platform_archon_
 export const PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF = 'platform:master:coolify-url';
 export const PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF = 'platform:master:coolify-token';
 export const PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF = 'platform:master:cloudflare-token';
+/**
+ * #436: a Coolify API token scoped to `read` only, for Archon's own
+ * `/backups` page (`COOLIFY_URL`/`COOLIFY_READ_TOKEN`, Archon's
+ * `src/lib/backups/coolify.ts`) -- deliberately not
+ * {@link PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF}'s root token, which a
+ * read-only status page must never hold. Coolify's token UI has no API
+ * counterpart to create one (`@wtfalch/providers`'s `CoolifyClient` doc:
+ * "Keys & Tokens -> API tokens" only), so a human creates it in Coolify's
+ * console and holds it under this ref; `provisionPlatformArchon` only reads
+ * it back, and pushes nothing until it is held. `COOLIFY_URL` needs no ref
+ * of its own: it is not secret, and {@link PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF}
+ * already holds the same panel's address.
+ */
+export const PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF = 'platform:archon:coolify-read-token';
 /**
  * #169: `platform:<service>` for the platform's own mail server (Stalwart),
  * mirroring {@link PLATFORM_AUTH_KEY} exactly.
@@ -777,7 +792,7 @@ export function planPlatform(platform, live, options = {}) {
         });
     }
     unmanaged.push(...backups.blocked);
-    return { plannedSteps, unmanaged, versionChanges };
+    return { plannedSteps: plannedSteps.map(withStepSystem), unmanaged, versionChanges };
 }
 /**
  * The platform's own Cloudflare zone for its shared apex (`platform.ts`'s

package/dist/plan/platform-org.d.ts

@@ -1,5 +1,21 @@
 import type { DeclaredPlatform } from '../platform.js';
 import type { AgoraHostValues } from './agora.js';
+/**
+ * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
+ * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
+ * `bouleHostnameFor` and `hostnames.ts`'s own `<slug>.oikos.host` already
+ * use for a level-1 org's hostnames. `OrgPlatformReadiness.mailHost.apex`
+ * used to be `platform.apex` (the platform's own brand apex, e.g.
+ * `companyincluded.com`), which gave a domainless org `slug@companyincluded.com`
+ * instead of the settled `slug@oikos.host` contract
+ * (`@wtfalch/email`'s `org-mail.ts`'s `resolveDomain` is the only reader of
+ * this `apex`, for a level-1 org alone -- a with-domain org returns
+ * `org.domain` and never looks at it). `mailHost` itself (the MX server's own
+ * hostname, `platformMailMxHost(platform.apex)`) is unaffected: the shared
+ * mail server stays the platform's own, whichever apex a mailbox's address
+ * uses.
+ */
+export declare const NO_DOMAIN_MAIL_APEX = "oikos.host";
 /**
  * https://github.com/wtfalch/foundry/issues/177: what an org step needs to
  * know about the platform it runs on -- whether each shared service it

package/dist/plan/platform-org.js

@@ -1,5 +1,21 @@
 import { JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
+/**
+ * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
+ * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
+ * `bouleHostnameFor` and `hostnames.ts`'s own `<slug>.oikos.host` already
+ * use for a level-1 org's hostnames. `OrgPlatformReadiness.mailHost.apex`
+ * used to be `platform.apex` (the platform's own brand apex, e.g.
+ * `companyincluded.com`), which gave a domainless org `slug@companyincluded.com`
+ * instead of the settled `slug@oikos.host` contract
+ * (`@wtfalch/email`'s `org-mail.ts`'s `resolveDomain` is the only reader of
+ * this `apex`, for a level-1 org alone -- a with-domain org returns
+ * `org.domain` and never looks at it). `mailHost` itself (the MX server's own
+ * hostname, `platformMailMxHost(platform.apex)`) is unaffected: the shared
+ * mail server stays the platform's own, whichever apex a mailbox's address
+ * uses.
+ */
+export const NO_DOMAIN_MAIL_APEX = 'oikos.host';
 /**
  * What an org's plan reads when no platform is declared: nothing is ready, so
  * every org step that depends on a platform service is blocked (#177). A host
@@ -73,7 +89,7 @@ noKeyReader = false) {
     };
     return {
         mailHost: mailApplied
-            ? { apex: platform.apex, mailHost: platformMailMxHost(platform.apex) }
+            ? { apex: NO_DOMAIN_MAIL_APEX, mailHost: platformMailMxHost(platform.apex) }
             : null,
         filesReady: filesApplied && missingKeys.files === null,
         filesUrl: filesApplied

package/dist/plan/platform-providers.d.ts

@@ -409,7 +409,7 @@ export interface PlatformMailRuntime {
  * {@link PlatformStepExecutionContext}, bundled like {@link PlatformAuthDeps}.
  */
 export interface PlatformArchonDeps {
-    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
+    coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord' | 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp'>;

package/dist/plan/platform-providers.js

@@ -7,7 +7,7 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -2365,7 +2365,15 @@ export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_clie
  *   does not parse fails the step without printing it.
  * - For each of files, ai, integrations and jobs that the platform declares
  *   enabled: its `https://<hostname>` URL, and its management key when
- *   {@link PlatformArchonDeps.heldKeys} holds one.
+ *   {@link PlatformArchonDeps.heldKeys} holds one. Files also gets
+ *   `FILES_ORGANISATION_ID` (`platform.ownerOrgId`, Company Included's own
+ *   Files organisation -- `executor.ts`'s `filesOrganisation` provisions it
+ *   under that same id) and its signed-assertion identity
+ *   (`FILES_MANAGEMENT_ISSUER`, `_KEY_ID`, `_PRIVATE_KEY`; #436).
+ * - `COOLIFY_URL`/`COOLIFY_READ_TOKEN` for `/backups`, once a human has
+ *   created a Coolify token scoped to read only and held it under
+ *   {@link PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF} -- that ref's own doc
+ *   comment says why foundry cannot mint one itself (#436).
  *
  * The OIDC client is ZITADEL's public web client (authorization code with
  * PKCE, no client secret: `createOidcApp` never returns one, see
@@ -2397,10 +2405,7 @@ export const PLATFORM_ARCHON_CLIENT_ID_SCOPE_KEY = 'zitadel_platform_archon_clie
  *   steps are exported by those steps' own modules. A
  *   missing one blocks the plan (`blockedSteps`); it is never skipped. The
  *   env names `AI_*`, `INTEGRATIONS_*`, `JOBS_URL` and `JOBS_ADMIN_TOKEN` are
- *   this step's proposal; Archon reads only `FILES_URL` and
- *   `FILES_MANAGEMENT_KEY` of these today. Files' signed-assertion identity
- *   (`FILES_MANAGEMENT_ISSUER`, `_KEY_ID`, `_PRIVATE_KEY`, `_SCOPE`) and
- *   `FILES_ORGANISATION_ID` are not wired.
+ *   this step's proposal.
  * - The step plans again when the hostname, `gitRef` or the Access policy's
  *   include list changes. Env for a service enabled later is not pushed until
  *   one of those changes.
@@ -2630,8 +2635,44 @@ async function provisionPlatformArchon(context, deps) {
     // unflagged, Coolify writes it into `.env` unquoted and the container never
     // starts.
     envs.push(...inputs.envs.map((e) => (e.value.includes('\n') ? { ...e, multiline: true } : e)));
+    // #436: /backups needs a Coolify token scoped to read only, never the
+    // root token `putArchonMasterKeys` above already held. Nothing mints that
+    // token over Coolify's API (this ref's own doc comment), so until a human
+    // creates one and holds it under PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF,
+    // this pushes nothing and /backups keeps showing its own "set COOLIFY_URL
+    // and COOLIFY_READ_TOKEN" message -- never a reason to block the rest of
+    // this step.
+    const coolifyReadToken = await deps.heldKeys.resolve(PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF);
+    if (coolifyReadToken) {
+        const coolifyUrl = await deps.heldKeys.resolve(PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF);
+        if (coolifyUrl) {
+            envs.push({ key: 'COOLIFY_URL', value: coolifyUrl }, { key: 'COOLIFY_READ_TOKEN', value: coolifyReadToken });
+        }
+    }
     const changed = await envsDiffer(deps.coolify, appId, envs);
     await deps.coolify.bulkUpsertEnvs(appId, envs);
+    // #436 round 2: `bulkUpsertEnvs` only adds or updates, so the
+    // `FILES_MANAGEMENT_KEY` this step used to write before the fix above
+    // would otherwise survive on an Archon already deployed with it --
+    // `filesManagementFetch` checks that var first, so a stale copy kept
+    // steering it into the issued-key path this issue's wiring fixes, and it
+    // left a second copy of the private key sitting in Coolify. Every row
+    // under this key, including `listEnvs`'s own preview duplicate, is
+    // deleted outright -- never overwritten, which would still leave a row.
+    //
+    // #462: the deletes happen after `changed` is already computed above, so
+    // a retry that finds the envs already matching (`changed` false) but a
+    // stale `FILES_MANAGEMENT_KEY` row still present must still redeploy --
+    // the running container otherwise keeps reading the stale key out of its
+    // own process env until someone redeploys by hand. `staleKeyDeleted`
+    // feeds `archonDeployedNow` below for exactly that case.
+    let staleKeyDeleted = false;
+    for (const stale of await deps.coolify.listEnvs(appId)) {
+        if (stale.key === 'FILES_MANAGEMENT_KEY' && stale.uuid) {
+            await deps.coolify.deleteEnv(appId, stale.uuid);
+            staleKeyDeleted = true;
+        }
+    }
     // ---- register with the broker (#204) ---------------------------------------
     // After Archon's own `AUTH_APP_KEY` is durably written above, so a throw
     // earlier in this function (a bad database URL, a Cloudflare failure) never
@@ -2756,6 +2797,7 @@ async function provisionPlatformArchon(context, deps) {
         app.justCreated ||
         !app.running ||
         changed ||
+        staleKeyDeleted ||
         appliedGitRef !== gitRef ||
         recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] !== hostname;
     if (archonDeployedNow) {
@@ -3309,11 +3351,31 @@ async function collectArchonServiceInputs(platform, deps, recorded) {
     const held = (ref) => heldByRef.get(ref);
     for (const service of services) {
         if (service === 'files') {
-            envs.push({
-                key: 'FILES_URL',
-                value: recorded[PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY],
-            }, {
-                key: 'FILES_MANAGEMENT_KEY',
+            envs.push(
+            // #436 round 2: not `PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY`'s
+            // internal `http://<name>:3000` -- Archon's signed path needs an
+            // exact HTTPS origin (`filesOrigin()`/`filesBaseUrl()`,
+            // `wtfalch/archon`'s `src/lib/authz/files-management.ts` and
+            // `src/lib/files-admin/client.ts`), and that origin is also the
+            // signing audience, so it must equal Files' own `APP_URL` exactly
+            // (this file, the files runner env above: `https://${platform.
+            // files.hostname}`).
+            { key: 'FILES_URL', value: `https://${platform.files.hostname}` }, 
+            // #436: Company Included's own Files organisation, provisioned by
+            // the ordinary per-org `planFilesOrganisation` step under its own
+            // org id -- `executor.ts`'s `filesOrganisation` calls
+            // `provisionOrganisation({ organisationId: org.id, ... })`, so
+            // `platform.ownerOrgId` is already that organisation's id, with no
+            // separate platform-level mint needed.
+            { key: 'FILES_ORGANISATION_ID', value: platform.ownerOrgId }, 
+            // #436: the signed-assertion identity `filesSigner()` reads
+            // (`archon`'s `src/lib/authz/files-management.ts`), not the bearer
+            // token `FILES_MANAGEMENT_KEY` used to name here -- that name made
+            // Archon take the issued-key branch of `filesManagementFetch`,
+            // which then failed on the `FILES_MANAGEMENT_SCOPE` this step never
+            // set, surfacing as "Files is not configured" (foundry#436).
+            { key: 'FILES_MANAGEMENT_ISSUER', value: FILES_MANAGEMENT_ISSUER }, { key: 'FILES_MANAGEMENT_KEY_ID', value: FILES_MANAGEMENT_KEY_ID }, {
+                key: 'FILES_MANAGEMENT_PRIVATE_KEY',
                 value: held(ARCHON_SERVICE_INPUTS.files.refs[0]),
             });
         }

package/dist/plan/providers-readers.d.ts

@@ -94,6 +94,8 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly resolveRecordedIds;
     constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
+    listProject(projectUuid: string): Promise<LiveResource[]>;
 }
 /**
  * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:

package/dist/plan/providers-readers.js

@@ -243,6 +243,10 @@ export class ProvidersCoolifyReader {
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded)));
         return applyRecordedIds(withBouleConfig, recorded);
     }
+    /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
+    async listProject(projectUuid) {
+        return toFoundryResources('coolify', await this.client.listResources(projectUuid));
+    }
 }
 /**
  * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:

package/dist/plan/rollout.d.ts

@@ -0,0 +1,52 @@
+import type { OrgId } from '../org.js';
+/**
+ * #259: ordered, stop-on-failure rollout across several orgs' own applies.
+ *
+ * Where the order itself comes from is still open (#259 "Decide": the
+ * platform declaration, one place, vs. spread across each org) -- this
+ * takes the order as a plain, caller-supplied list, so it works unchanged
+ * whichever way that is answered. `apply` is the caller's own one-org apply
+ * (typically `plan` then `PlanApply.apply`, confirmation and all) -- this
+ * file knows nothing about that shape, only whether it threw.
+ *
+ * "Stop at the first failed health check" (the issue's own words) is, today,
+ * "stop at the first `apply` that throws" -- the shared health helper
+ * (`deploy-health.ts`'s `waitForNewDeployment`) is not yet wired into the
+ * org-level calls stack deploy (`executor.ts`'s `coolifyCalls`/
+ * `coolifyCallsService` only ever fire-and-forget deploy, and never patch a
+ * running app's image tag at all -- see `org.ts`'s `CallsConfig.versionPin`
+ * doc comment). Once that step itself throws on a failed health check, a
+ * caller's `apply` naturally does too, and this orchestration needs no
+ * change.
+ */
+/** One org's outcome from {@link applyOrgsInOrder}. */
+export interface RolloutOrgResult {
+    readonly orgId: OrgId;
+    readonly outcome: 'applied' | 'skipped' | 'failed';
+    /** Set only for `'failed'` -- the thrown error's own message. */
+    readonly error?: string;
+    /**
+     * Set only for `'applied'`, when `soakMs` names one for this org: the ISO
+     * time the caller should wait until before applying the next org. Never
+     * slept here (CLAUDE.md "Platform steps" rule 5, and the issue's own "Make
+     * the soak a declared value the caller supplies, not a sleep inside
+     * foundry") -- a caller that wants to honour it re-invokes later, from
+     * `orgIds` sliced after this result's own org.
+     */
+    readonly soakUntil?: string;
+}
+export interface RolloutOptions {
+    /** This org's soak window in milliseconds, or `undefined`/`0` for none (a stateless service). */
+    soakMs?: (orgId: OrgId) => number | undefined;
+    /** Overridable for tests; defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Applies every org in `orgIds`, in order, stopping at the first `apply`
+ * that throws: every org after it is reported `'skipped'` without `apply`
+ * ever being called for it, so it is left exactly as it was. An org whose
+ * own `apply` throws is reported `'failed'` with that error's message --
+ * `apply`'s own implementation decides what, if anything, it recorded
+ * before throwing (this function never inspects or rolls back that state).
+ */
+export declare function applyOrgsInOrder(orgIds: readonly OrgId[], apply: (orgId: OrgId) => Promise<unknown>, options?: RolloutOptions): Promise<RolloutOrgResult[]>;

package/dist/plan/rollout.js

@@ -0,0 +1,37 @@
+/**
+ * Applies every org in `orgIds`, in order, stopping at the first `apply`
+ * that throws: every org after it is reported `'skipped'` without `apply`
+ * ever being called for it, so it is left exactly as it was. An org whose
+ * own `apply` throws is reported `'failed'` with that error's message --
+ * `apply`'s own implementation decides what, if anything, it recorded
+ * before throwing (this function never inspects or rolls back that state).
+ */
+export async function applyOrgsInOrder(orgIds, apply, options = {}) {
+    const now = options.now ?? Date.now;
+    const results = [];
+    let stopped = false;
+    for (const orgId of orgIds) {
+        if (stopped) {
+            results.push({ orgId, outcome: 'skipped' });
+            continue;
+        }
+        try {
+            await apply(orgId);
+            const soak = options.soakMs?.(orgId);
+            results.push({
+                orgId,
+                outcome: 'applied',
+                ...(soak ? { soakUntil: new Date(now() + soak).toISOString() } : {}),
+            });
+        }
+        catch (error) {
+            results.push({
+                orgId,
+                outcome: 'failed',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            stopped = true;
+        }
+    }
+    return results;
+}

package/dist/plan/step-system.d.ts

@@ -0,0 +1,22 @@
+import type { PlanStep } from '../plan.js';
+import type { StepAction } from './diff.js';
+import type { LiveResource } from './live.js';
+/**
+ * The system a plan step or progress event touches, for Archon to draw as a
+ * tag. A superset of {@link LiveResource}'s `system` (where a resource
+ * lives): a step that deploys Stalwart, Synapse or a Postgres database
+ * through Coolify names that system, not the deployer.
+ *
+ * `foundry` is for a progress event that covers more than one system, or
+ * none (a round of mixed steps, the closing event). No plan step carries it.
+ */
+export type StepSystem = LiveResource['system'] | 'stalwart' | 'matrix' | 'postgres' | 'foundry';
+/** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
+export declare function stepSystemOf(action: StepAction): StepSystem;
+/** The step with its `system` set from `action`. */
+export declare function withStepSystem<T extends {
+    step: Omit<PlanStep, 'system'>;
+    action: StepAction;
+}>(planned: T): T & {
+    step: PlanStep;
+};

package/dist/plan/step-system.js

@@ -0,0 +1,37 @@
+/** Which system a platform `app` step (keyed `platform:<service>`) runs. */
+const PLATFORM_APP_SYSTEMS = {
+    'platform:auth': 'zitadel',
+    'platform:mail': 'stalwart',
+    'platform:files': 'files',
+    'platform:ai': 'ai',
+};
+/** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
+export function stepSystemOf(action) {
+    switch (action.kind) {
+        case 'mail':
+        case 'mail-copy':
+            return 'stalwart';
+        case 'chat':
+        case 'calls':
+        case 'calls-service':
+            return 'matrix';
+        case 'database':
+        case 'adopt-database':
+        case 'backup':
+            return 'postgres';
+        // Re-registers the R2 bucket's credentials with Coolify: the bucket is what it writes to.
+        case 'backup-storage':
+            return 'cloudflare';
+        // The platform's jobs scheduler app, like the org's own `jobs` registration.
+        case 'jobs':
+            return 'jobs';
+        case 'app':
+            return PLATFORM_APP_SYSTEMS[action.key] ?? action.system;
+        default:
+            return action.system;
+    }
+}
+/** The step with its `system` set from `action`. */
+export function withStepSystem(planned) {
+    return { ...planned, step: { ...planned.step, system: stepSystemOf(planned.action) } };
+}

package/dist/plan.d.ts

@@ -1,4 +1,5 @@
 import type { OrgId } from './org.js';
+import type { StepSystem } from './plan/step-system.js';
 /**
  * One step of a {@link Plan}.
  *
@@ -9,6 +10,8 @@ import type { OrgId } from './org.js';
  */
 export interface PlanStep {
     description: string;
+    /** The system this step touches, for Archon to tag it with. Set from the step's action, never by hand (`plan/step-system.ts`). */
+    system: StepSystem;
     /**
      * True when this step deletes or replaces data the org cannot get back
      * without foundry's own backup: a chat re-key, an issuer move, a mail

package/dist/state.d.ts

@@ -12,6 +12,17 @@ export interface Checkpoint {
     step: string;
     completedAt: string;
 }
+/** One step of a destroy: `finished`, `failed` (with `error`), `started` (in flight; a crash leaves it so), or `planned` (not reached yet). */
+export interface DestroyStepRecord {
+    step: string;
+    status: 'planned' | 'started' | 'finished' | 'failed';
+    completedAt?: string;
+    error?: string;
+}
+/** Foundry's record of the current or most recent destroy of an org, in step order. */
+export interface DestroyRecord {
+    steps: DestroyStepRecord[];
+}
 /**
  * When an apply last completed, and against which declared org version.
  *
@@ -81,4 +92,6 @@ export interface AppliedState {
     failedFields: string[];
     /** `null` before this org has ever had a completed apply. */
     lastApplied: LastApplied | null;
+    /** The destroy that started for this org, if any. Absent until one has. */
+    destroy?: DestroyRecord | null;
 }

package/dist/store/audit.js

@@ -14,10 +14,11 @@ const FOUNDRY_LEDGER_VOCABULARY = ledgerVocabulary({
         'plan.computed': { tenantVisible: false },
         'apply.recorded': { tenantVisible: false },
         'destroy.recorded': { tenantVisible: false },
+        'adoption.recorded': { tenantVisible: false },
     },
     actorClasses: ['operator'],
     contexts: ['operator'],
-    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed'],
+    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed', 'adopted', 'released'],
 });
 /**
  * The ledger table's CHECKs (migration 0024): reason <= 512 chars, `after`
@@ -110,6 +111,19 @@ export function createPostgresAuditLog(db, options = {}) {
                 occurredAt: at,
             });
         },
+        async recordAdoption({ actor, orgId, action, entryKey, outcome, reason, at }) {
+            await ledger.sign(db, {
+                action: 'adoption.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId),
+                outcome,
+                reason: boundReason(reason),
+                after: { action, entryKey },
+                occurredAt: at,
+            });
+        },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {
             await ledger.sign(db, {
                 action: 'destroy.recorded',

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { AppliedVersionsStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
+import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore, type RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in